The company processes the personal information acquired from the subject for each of the following purposes and does not modify the purpose of the use or use of the information for other reasons without the subject's prior agreement.

• ① The company processes and retains personal information within the period of retention and use of personal information required by applicable laws and regulations, or within the period of retention and use of personal information agreed upon at the time personal information was collected from the information subject.
• ② Each processing and retention period for personal information is outlined below.

  Article 2 (Processing and Retention Period of Personal Information)

  Division	Retention Period
  Customer Inquiries	- 1 month from the date of inquiry
  Reporting of Unethical Acts	- 3 years after completion of handling reporting-related measures, etc.

• ③ Regardless of the retention period specified in the preceding paragraph, if the information subject explicitly requests deletion by a proper procedure and method, the information will be deleted without delay.

• ① The company processes the personal information of the information subject solely within the scope defined in the purpose for processing personal information. Only in cases covered by Articles 17 and 18 of the "Personal Information Protection Act," such as consent of the information subject and special provisions of the law, shall personal information be provided to third parties; otherwise, personal information of the information subject shall not be provided to third parties.
• ② To offer a seamless service, the company will only disclose the minimum necessary with the agreement of the information subject in the following instances:

  Article 3 (Items Pertaining to the Provision of Personal Information to Third Parties)

  Recipients	Purpose of Use by the Recipient	Provided Items	Period of Retention and Use
  KT&G AffiliatesView list	Investigation of reports of unethical actions and confirmation of results	- Name, contact information, email, Reports (Type / Title / Content) - Country / Attachment * Collection of optional items Provided only when received consent to use	Deleted promptly upon the completion of report-related measures, and so on.
  KT&G Consigned Operator / Partners

• ① The company delegates the following responsibilities for efficient business operations.

  Article 4 (Consignment of Personal Information Processing)

  Consignees	Duty and Purpose of Consignees	Items of Personal Information	Period of Retention and Use
  Easymedia	Web page development/maintenance/analysis	All personal information gathered via the website, including name, contact information, and e-mail address (refer to Article 6)	Until the end of the consignment contract term (does not own separately)
  SK C&C	Infrastructure (DB) operation	All personal information gathered via the website, including name, contact information, and e-mail address (refer to Article 6)	Until the end of the consignment contract term (does not own separately)

• ② By Article 26 of the Personal Information Protection Act, when a company enters into a consignment contract, the contract must include provisions regarding the company's responsibilities, such as the prohibition of processing personal information for purposes other than the performance of entrusted tasks, technical and administrative protection measures, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages. Moreover, the company supervises the trustee's safe handling of personal information.
• ③ The company shall immediately notify any changes to the consignment's contents or consignee through this Privacy Statement.

• ① The information subject may at any time exercise the following rights relevant to the protection of personal information against the company.
  • A. Request to read personal information
  • B. Request for correction in case of errors, etc.
  • C. Request for deletion
  • D. Request to suspend the processing
• ② If you contact the reception/processing department or submit a written request to exercise rights such as a request for reading, the company will respond promptly.
  • A. Inquiry by phone or email
  • B. Request in writing via email

  Reception and Processing Department

  Article 5 (Reception and Processing Department)

  Reception and Processing Department
  Person in Charge / Department	Oh Ju-yeon / PR Department
  Contact Information	02-3404-4202
  Email	smile-amanda@ktng.com

• ③ An authorized agent of the information subject may exercise a subject's rights, such as a request for a reading. The following power of attorney must be provided in this instance.
• ④ If the information subject requests rectification or deletion of personal information, the company will refrain from using or disclosing the information until the request is fulfilled.
• ⑤ The company handles personal information that has been canceled or destroyed at the information subject's request in accordance with Article 2 (Processing and Retention Period of Personal Information) in a way that prevents it from being accessed or used for any other reason.
• ⑥ The information subject may not violate the personal information and privacy of the information subject or other individuals in violation of applicable laws such as the Personal Information Protection Act.

• ① The following personal information is handled by the company:

  Article 6 (Processed Items of Personal Information)

  Division	Items of Personal Information
  Customer Inquiries	[Required] Name, email, inquiry (type/title/content), whether older than 14 years or not [Optional] Attachments
  Reporting of Unethical Acts	[Required] Name, contact information, e-mail, report information (type/title/content), Password to confirm the post, whether older than 14 years or not [Optional] Country, Attachments

• ② In addition to the personal information described in Paragraph 1, the following information may be automatically produced and collected over the course of using the service:

  - Browser information and IP address: Statistical service usage analysis and prevention of illegal/unauthorized use

• ③ Other sensitive information will not be handled, including ideology/belief, union/party membership/withdrawal, political opinion, and sex life.

• ① The company destroys personal information without delay when it is no longer necessary, such as when the personal information retention term has expired or the processing purpose has been fulfilled.
• ② If the personal information retention period agreed upon by the information subject has expired or if the personal information must be kept in accordance with other laws despite the attainment of the processing purpose, the personal information will be transferred to a separate database or stored in a different storage location.
• ③ The technique and method for destroying personal information are as follows.

  A. Destruction procedure
  With the agreement of the company's personal information security officer, the company destroys the personal information for which the reason for deletion has occurred.

  B. Destruction method
  In the event of recordings, prints, handwriting, and another non-electronic recording medium, the company uses a shredder or an incinerator to destroy them.

The company uses "cookies" that automatically store and retrieve user data to present customers with personalized services.

• A. Cookie: A very little text file supplied to the user's browser and saved on the user's computer by the server that operates the website.
• B. Refusal to install and collect cookies: Users have the choice to install cookies and can choose whether to accept all cookies, verify each cookie saved, or refuse to save all cookies by configuring the parameters in their web browser. However, utilizing some services could be challenging if you choose not to install cookies.

  - For Internet Explorer
  · In Internet Explorer, select the Tools button > Select Internet Options
  
  · Select Privacy tab > Select Advanced in Settings > Select Block or allow cookies

  - For Microsoft Edge
  · After clicking the ‘….’ mark in the upper right corner of Edge, click the Settings
  
  · On the settings screen, click "Personal information, search, and service". Choose the level and "Do not track" from the "Anti-Tracking" option.
  
  · Select the always browse InPrivate with "strict" tracking protection.
  
  · Select the “Send the Request of Do Not Track” in the Personal Information section below

  - For Chrome
  · In Chrome, click the '⋮' mark (Customize and Control Chrome) at the upper right > Click Show Settings
  
  · Click “Show advanced settings” at the bottom of the settings page > Click Content Settings in the Privacy section
  
  · Check the box for “Block third-party cookies and site data” in the Cookies section

• C. Purpose of automated collection and the items collected

  Article 8 (Purpose of automated collection and the items collected)

  Purpose of Collection	Collected Items	Retention Period
  Statistical analysis and use against illegal/anti-corruption	Browser information, IP address	1 month
  Provision of customized service (Retention of user's preferences)	Cookie	15 minutes

In compliance with Article 29 of the Personal Information Protection Act, the company is implementing the procedures outlined below.

• A. Administration measures: Establishment and implementation of internal management plans, frequent staff training, and a reduction in the number of individuals entrusted with the handling of personal data.
• B. Technical measures: Management of access rights to personal information processing systems, etc., installation of an access control system, encryption of passwords, and installation of a security program
• C. Physical measures: Restriction of access to personal data storage areas such as computer centers

• ① The company is responsible for the overall management of personal information and has appointed the following individual as the person in charge of personal information protection to handle complaints and damage settlement relating to the processing of personal information.

  Privacy Protection Officer and Privacy Protection Manager

  Privacy Protection Officer		Privacy Protection Manager
  Name	Park Young-jo	Name	Cho Gyeong-cheon
  Position	Head of Information Security	Department	Information Security Department
  Contact Info.1(Tel)	042-939-5347
  Contact Info.2(Email)	kcjo@ktng.com

• ② The information subject may address all personal information protection-related inquiries, complaint management, damage alleviation, etc. that happened while using the company's services (or business) to the person in charge of personal information protection and the responsible department. The company shall promptly reply to and manage the information subject's inquiries.
• ③ The information subject may submit a request for dispute resolution or consultation to the Personal Information Infringement Report Center, the Personal Information Dispute Mediation Committee, or the Korea Internet & Security Agency in the event of a personal information breach. For complaints and consultations about breaches of personal information, please contact the following institutions.

  - Personal Information Infringement Report Center: (without area code) 118 (http://privacy.kisa.or.kr)

  - Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (http://kopico.go.kr)

  - Cyber Investigation Division, Supreme Prosecutors' Office: (without area code) 1301 (http://spo.go.kr)

  - Cyber Investigation Bureau, National Police Agency: (without area code) 182 (http://ecrm.cyber.go.kr)

This personal information processing policy is effective as of the effective date, and the company will notify you via the company website (www.ktng.com) on the effective date of any additions, deletions, or corrections required by applicable laws and regulations.